Your cyber plan
in stages.
Three levels. One starting point. Every customer begins with Level 0 — people, culture, reporting habits — before any technical control is locked down. Then Essential Eight Level 1 across four phases. Level 2-3 if and when it makes sense.
Three levels.
One starting point.
Every Red Flagg™ customer follows the same arc. We start with people, then we layer in the technical controls, then we monitor and improve. No one skips Level 0. No one starts at Level 1. The order matters.
and culture
The foundation. Where every customer starts.
Level 0 is something Red Flagg™ does that many cyber providers don't. They focus on technical settings first. We start with people. Awareness, reporting habits, and a culture where staff feel safe to speak up are what make every other step work. Without this, no technical layer holds for long.
Your team becomes your first and strongest line of defence. We run training, send simulated phishing tests, and build the way staff report things. We deploy the password manager and lock down email domain spoofing. And we set up clear paths for what to do when something feels off.
Eight
The Australian Government baseline. 48 controls. Four phases.
Level 1 is the full ACSC Essential Eight Maturity Level 1 — the technical baseline cyber standard for Australian organisations. We deliver the 48 controls progressively over 12 to 24 months in most environments, longer for complex ones. Your analyst will give you a specific timeline for your environment after the audit. Each control sticks, and your team isn't overwhelmed.
This is the journey detailed below. Application Control. Multi factor authentication. Patch cadence. Macro hardening. Browser lockdown. Backup. Admin separation. It's only meaningful if Level 0 is solid first. Without an awareness culture, the technical controls have nothing holding them up.
and advanced
Consistent, monitored controls built into daily operations.
Level 2 and Level 3 are for organisations with higher risk exposure, regulatory scrutiny, or funder audit requirements. The controls become more strict, the monitoring becomes continuous, and the response capability becomes more sophisticated.
This isn't a journey we promise on day one. It's a conversation we have with customers who've completed Level 1, are seeing real maturity in their day to day operations, and have a regulatory or operational reason to go further.
Examples of what Level 2-3 might include:
Every Level 2-3 engagement is scoped, costed, and timed against your specific environment. We don't sell it as a package because it isn't one.
So your team always
knows what to expect.
Every action in your plan gets one of three colours. You'll see them in your scorecards, in your reports, and in conversation with your analyst. No guessing what's next.
Green · Quiet
Background work. We do it. Your team won't notice. No staff disruption, no behaviour change, no learning curve.
Amber · Approval needed
Approval and comms. You sign off. Brief staff message needed. Light disruption — usually a one off prompt or setting change.
Red · Real change
Real change. Workflows shift, training needed, some friction. Proper change management with your leadership and your team.
How we deliver
Essential Eight Level 1.
Once Level 0 is solid, this is how the 48 Essential Eight Level 1 controls get rolled out. Each phase builds on the one before. Most of the work is quiet — green and amber together account for the majority of controls. The red ones get planned carefully, communicated clearly, and never sprung on your team.
the easy ones
the bolts
heavy lifting
finish line
This is a partnership.
Some decisions are ours — configuration, deployment, ongoing monitoring. Some decisions are yours — what's an approved application list, who needs admin access, what counts as sensitive data. Your analyst guides you through the choices that belong to you. There are no surprises and there's no blame attribution. We work it out together.
Costs beyond your subscription.
- Microsoft 365 BackupConsumption based pricing. We walk you through it before anything is turned on.
- Privileged access hardwareOne to three admin users may need a dedicated environment in Phase 3. Could be a device, a VM, or a privileged access workstation.
- Defender Vulnerability ManagementA paid Microsoft add on. Only needed if your environment requires daily server scanning.
Built around
what regulators expect.
Our framework aligns to the standards Australian regulators reference when they assess cyber posture. Your scorecard tells the story to your board, your funders, and — if it ever comes to it — the regulator.
This framework supports your obligations under the Australian Privacy Principles and the Notifiable Data Breach scheme, and helps not for profits demonstrate cyber maturity to funders and the ACNC. It is not a substitute for your own privacy and governance obligations.
For US and international customers. The Essential Eight maps directly to NIST Cybersecurity Framework functions (Identify, Protect, Detect, Respond, Recover) and CIS Controls v8. If you operate under HIPAA, SOC 2, ISO 27001, or other international frameworks, your analyst will walk you through the equivalent control mapping for your sector.
The terms
worth knowing.
A few terms come up across the framework. Here they are, in plain English, so when your analyst uses them you're not flying blind.
Ready to start
the journey?
Book a free Cyber Maturity Assessment. We'll walk you through where you are, what's possible, and what your first 90 days could look like. No jargon. No pressure. We'll be in touch within one business day.